merge: integrate per-user module access

.project-docs/30-worklog/current-state.md

@@ -4,6 +4,7 @@ This file is the integrated default-branch snapshot. Feature tasks record progre
 
 ## Integrated Through
 
+- `3b799af`: per-user Code/Canvas/Learning/Robot entry policy from Works Square, projected by Electron Main as four booleans and enforced before disabled module routes initialize.
 - `01bee31`: enabled AI Learning course catalog/generation/download/playback, Main-owned cloud/runtime bridges, verified external OpenMAIC player-artifact packaging, account profile reuse, removal of the transient `game-engine` Skill, and project-root `planning-with-files` output from the authoritative remote main. The merge hardens this with strict DTO/error projection, account-isolated local state, bounded same-origin downloads/packages, a nonce-protected account-bound player HTTP session, and an exact-source/origin single-document iframe bridge.
 - `26b52d7`: Canvas Prompt Museum, editable server-priced generation Quotes, project deletion/task-detail workflow, cloud-default Canvas development entry, and Chinese-only UI consolidation from the authoritative remote main. Its transient bundled `game-engine` Skill is superseded by `01bee31`.
 - `c1326a2`: Guided Hotspot Binding now scans bounded open `Xiaozhi-*` candidates and connects the user-selected hotspot inside the page through Main-owned Windows WLAN and macOS CoreWLAN/CoreLocation adapters; system Wi-Fi remains fallback, exact `=0` rollback and firmware/cloud contracts are unchanged.
@@ -34,6 +35,8 @@ AI 绘画的一个 Workspace 可包含多条 Conversation。消息、Brief、Quo
 
 Canvas 侧栏提供“获取灵感”进入 Prompt Museum。列表、筛选、分页、详情、作者/来源/许可证和图片地址全部由服务端经 Main-owned Host API 提供，客户端不打包静态数据集；“使用此 Prompt”只把原文带回当前 Canvas 输入框，不自动发送。该模块不是投稿、点赞、评论或排行榜社区。客户端契约已就绪，但不据此宣称 Works Square 内容后台和生产数据已经部署。`pnpm run dev` 现在默认使用云端 Canvas 适配器，本地适配器只能通过显式开发命令启用；产品 UI 只保留中文。
 
+Makelore 在会话恢复、登录和刷新后由 Electron Main 请求 Works `/api/auth/me`，Renderer 只获得 Code、Canvas、Learning、Robot 四个布尔权限。缺失 `module_access` 或任一字段时默认开启；服务端 `design` 显式映射客户端 `painting`。被关闭的模块卡片置灰且不可点击，根路由、深层路由和别名路由均在 `MainLayout` 或模块初始化前阻断。Code provider 等待认证权限加载完成；权限查询返回终止性 `401` 时同时清理 Main 和 Renderer 会话。`/settings` 是全局设置，不受 Code 入口策略阻断。该机制只是客户端入口策略，不代替服务端 API 授权。
+
 AI 学习现在是已启用顶层模块。Renderer 浏览 Works 课程、提交单课生成需求、显示任务进度并打开已安装课程；材料上传经 Main IPC 严格投影，需求最多 4,000 字，文件最多 5 个、单个 50 MiB、总计 150 MiB。Main 持有 Works Token、生成/课程下载/Agent/ASR/课堂 runtime 访问和按认证身份派生的不透明账号分区；账号切换、注销或 epoch 变化会隐藏旧本地课程、关闭旧 player server 并丢弃迟到结果。课程归档最大 512 MiB，只允许同 Works origin、最多 5 跳且不携带资源 Bearer 的下载重定向，按服务端声明大小与 SHA-256 校验后原子安装并在播放前再次校验。安装期和 player server 只允许 MIME/扩展匹配的被动图片、音视频和字体；同源 HTML/SVG/XML/脚本/PDF 被拒绝，运行时响应带 nosniff/sandbox CSP/CORP/no-store。只有显式 `readClassroom` 会注册课程；Agent/runtime 先验证调用前既存 active registration，再用无副作用 resolver 核对本地 aggregate/module，不能靠自身请求注册。HTTP URL/cookie 由短效 nonce 保护；iframe bridge 校验精确 source/origin，只允许初始 player 文档，二次导航后永久关闭。课程 aggregate `contentHash` 是云端权益/进度身份，模块 hash 只作为受控上下文。打包必须提供由固定清单与 SHA-256 验证的 OpenMAIC production Stage 产物；当前客户端自动化不等同于真实 Works 课程服务、生产播放器产物或签名安装包验收。
 
 AI 编程首次发送在新建 OpenCode session 已知为空时不再等待冗余历史读取，prompt 可直接进入 Host API；普通历史会话仍刷新消息。Main AI proxy 只把明确的上游分组饱和投影为当前 OpenCode 的终止状态，配额耗尽保持独立终止态，通用限速继续保留 `429`。上下文压缩以每个 Session 的持久时间线事件呈现：自动与手动压缩使用不同文案，运行态原位弱化显示，完成后静态保留并可从历史恢复；`session.compacted` 只完成对应事件，只有真实 idle 才结束 run 和释放排队消息。
@@ -44,6 +47,7 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 
 ## Recently Completed
 
+- 2026-08-17: Integrated the reviewed per-user module-entry policy source tip `3b799af`. Main exposes only four booleans from `/api/auth/me`; missing fields remain enabled, `design` maps to `painting`, disabled root/deep/alias routes stop before module initialization, Code provider startup waits for policy hydration, terminal `401` clears both session layers, and global settings remains reachable.
 - 2026-08-17: Integrated remote `01bee31`: Learning is enabled with course browsing, strict bounded generation materials, verified atomic course installation, multi-module playback, Main-owned Agent/ASR/runtime bridges, and a manifest-verified external OpenMAIC player artifact. Merge review added account-isolated generation/library/player state, fixed-binding token/fetch/401 guards, passive-only course media with hardened responses, pre-existing active-registration checks before side-effect-free identity resolution, nonce-protected single-document player sessions, and a recoverable deep-link profile error gate. Publishing now reflects the actual Works contract: first create is coverless, existing draft/published are version-only, and races fail closed without cover/PATCH side effects. The transient `game-engine` Skill was removed and `planning-with-files` writes its files to the project root. Production Works/player-artifact/signed-package acceptance remains pending.
 - 2026-08-16: Integrated remote `26b52d7`: Canvas now has server-backed Prompt Museum navigation, editable server-repriced generation Quotes, task result details/downloads, guarded project deletion, cloud-default development, and Chinese-only UI. That tip briefly bundled `game-engine`; authoritative successor `01bee31` removed it. Client integration is verified separately from production Prompt Museum data/backend deployment.
 - 2026-08-16: Integrated Windows/macOS in-page Robot hotspot discovery, explicit selection, connection, and exact-current-SSID verification behind the existing default-on guided capability. Candidate IDs are bounded and short-lived, native diagnostics stay in Main, system settings remain fallback, and firmware/Portal/Binding contracts are unchanged.
@@ -71,9 +75,10 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 
 ## Next Recommended Steps
 
-1. 使用真实 Works 账号和固定 SHA-256 的 production Stage artifact 验收 Learning 课程目录/生成/材料上传/取消恢复、下载、离线播放、进度、Agent、ASR、PBL/评分 runtime，并完成 Windows 与签名 macOS 安装包 smoke。
-2. 对 default-on Guided Hotspot Binding 核对指定固件镜像与六位码发行/消费契约，补齐 Windows 真机热点连接、签名 macOS x64/arm64 CoreWLAN/CoreLocation/worker 打包验证、真实 Host API/native seam Electron E2E 和完整真机 smoke；发布支持保留精确 `=0` 回滚，不把缺失证据表述为已验收。
-3. 成组核对客户端 source+built+contract 上传 → 服务端逐字节校验 → OSS immutable Release → CDN/Edge 的发布契约与客户端 `play_url` 消费契约。
+1. 部署 Works `module_access` migration 与 `/api/auth/me` 权限 API，打包新 Makelore 客户端，再用真实账号分别关闭 Code、Canvas、Learning、Robot 执行卡片、根/深层/别名路由 smoke；同时独立验证模块 API 服务端授权。
+2. 使用真实 Works 账号和固定 SHA-256 的 production Stage artifact 验收 Learning 课程目录/生成/材料上传/取消恢复、下载、离线播放、进度、Agent、ASR、PBL/评分 runtime，并完成 Windows 与签名 macOS 安装包 smoke。
+3. 对 default-on Guided Hotspot Binding 核对指定固件镜像与六位码发行/消费契约，补齐 Windows 真机热点连接、签名 macOS x64/arm64 CoreWLAN/CoreLocation/worker 打包验证、真实 Host API/native seam Electron E2E 和完整真机 smoke；发布支持保留精确 `=0` 回滚，不把缺失证据表述为已验收。
+4. 成组核对客户端 source+built+contract 上传 → 服务端逐字节校验 → OSS immutable Release → CDN/Edge 的发布契约与客户端 `play_url` 消费契约。
 
 ## Open Questions / Blockers
 
@@ -81,6 +86,7 @@ Robot 绑定设备默认先显示“引导配网 / 已有激活码”路径选
 
 ## Risky Areas
 
+- 四模块权限只控制 Makelore 客户端入口和初始化，不是 API 授权边界。不得因卡片置灰或路由阻断而放宽 Works/模块服务端的身份与权限校验；旧服务端缺少对象/字段时默认开启是显式兼容策略。
 - Learning 的课程目录、生成、Agent、ASR 与 runtime 都依赖真实 Works 权益和服务端契约；本地课程归档与播放器 artifact 必须在信任前完成边界、大小与摘要校验。账号分区/epoch、fixed-binding token+fetch guards、同源重定向、512 MiB 上限、player nonce、exact source/origin 与单文档 bridge 边界不可放宽；不得把模块/场景自报身份当成 aggregate 课程权益，也不得把上游错误、Token、内部 URL 或本地归档路径投影到 Renderer。
 - Works Project 服务当前没有 metadata revision/ETag、draft-only 条件写或封面删除/原子绑定合同；首次发布暂不上传封面，已有 draft/published 只允许 version-only。恢复封面或已有资料编辑前必须先扩展并真实验证服务端原子合同，客户端不得以无条件 PATCH 或孤立上传替代。
 - Guided Hotspot Binding 默认开启并提供未经认证的热点扫描/显式连接，但当前 Hotspot/portal 仍是开放 SoftAP + 明文 HTTP，且精确出货镜像、激活码发行契约、签名 macOS、Windows 真机与完整整链尚未验证。界面必须保留环境警告，异常发布可用精确环境值 `0` 回滚；不得把 SSID 前缀宣称为可信设备发现、自动认领或在线证明。

.project-docs/30-worklog/tasks/20260813-sync-push-main-9c2f71.md

@@ -12,6 +12,7 @@
 
 ## Scope
 
+- On 2026-08-17, resume the existing Integration owner after the user's explicit takeover authorization to preserve the task's existing uncommitted record, merge reviewed Makelore module-access source tip `3b799af` into local `main`, promote its accepted per-user entry-policy facts, run merged-tree verification and independent review, and keep remote push outside this resumption unless separately authorized.
 - On 2026-08-16, resume the existing Integration owner after the user restored remote credentials: fetch authoritative `origin/main`, complete the already-started merge of remote tip `26b52d7`, preserve both remote Canvas/Prompt Museum work and local Robot hotspot work, run merged-tree verification and independent review, then perform a normal non-forced push and verify remote-tip equality.
 - On 2026-08-16, resume the existing Integration owner to merge reviewed cross-platform in-app Robot hotspot connection source `c1326a2` into local `main`, supersede only ADR-002's manual operating-system hotspot-selection step, preserve firmware/credential/Binding boundaries, and keep remote push outside this resumption.
 - On 2026-08-16, resume the existing Integration owner to merge reviewed default-on Guided Hotspot Binding source `b78fc07` into local `main`, accept the user's explicit reversal of the prior default-off policy, preserve exact environment value `0` as rollback, and keep firmware edits and remote push outside this resumption.
@@ -52,6 +53,7 @@
 - The user's latest instruction explicitly authorizes default-on and supersedes only the earlier default-off/capability-not-enabled constraint. It does not authorize firmware changes, automatic discovery/claim claims, arbitrary portal URLs, Wi-Fi credential handling, or remote push. Missing installed-Electron/physical-device evidence remains an explicit residual release risk, not completed evidence.
 - The user has now explicitly authorized page-owned selection and connection of nearby open `Xiaozhi-*` provisioning hotspots on both Windows and macOS. This supersedes only manual operating-system hotspot selection; discovery remains unauthenticated convenience, Main remains the sole native-network owner, and signed macOS plus physical-Robot smoke remain release gates.
 - The latest instruction explicitly authorizes fetching, semantically resolving conflicts, and pushing `main`. Use the existing merge topology; do not rebase, reset, stash, discard remote/local commits, or force-push. Preserve remote Prompt Museum/Canvas/Chinese-only/Skill behavior alongside the already reviewed local Robot native hotspot path and `koffi` packaging.
+- The 2026-08-17 takeover confirmation authorizes continuing this existing Integration owner while preserving its uncommitted task history. For module access, source-task records remain read-only; the policy is a client entry/initialization gate rather than API authorization, and release acceptance requires the matching Works migration/API, a newly packaged client, and real-account four-module smoke.
 
 ## Project Context Loaded
 
@@ -99,6 +101,14 @@ Relevant understanding:
 Gate result:
 - Passed.
 
+### 2026-08-17 Per-User Module Access Integration Resume
+
+- Reused the existing Integration owner after the user explicitly authorized takeover while preserving its uncommitted record. Registry status still identifies task `20260813-sync-push-main-9c2f71`, mode `integration`, branch `main`, and worktree `D:\Datas\OthersProjects\makelore`; no new task context was created.
+- Verified source task `20260817-makelore-module-access-6f2a91c4` is `ready_for_integration`, source tip `3b799af` is present as the current `MERGE_HEAD`, and the no-ff/no-commit merge stages the reviewed product changes. Its task record remains read-only on the source branch and is deliberately excluded from the integrated `main` tree.
+- Read the source outcome, verification, follow-up and promotion candidate against the Main-owned Works Session boundary and current four-module model. No accepted ADR or peer source contradicts default-open compatibility, `design` → `painting`, pre-layout route blocking, global `/settings`, terminal `401` session cleanup, or the explicit non-authorization boundary.
+- Integration outcome remains pending until canonical reconciliation, merged-tree checks, independent final review and the final merge commit complete. The final merge SHA does not yet exist and must not be invented.
+- Gate result: Passed for canonical promotion and merged-tree verification. Works migration/API deployment, a newly built client package, real-account four-module smoke and server-side API authorization validation remain release commitments.
+
 ### 2026-08-16 Remote `26b52d7` Synchronization Resume
 
 - Reused the existing Integration owner and refreshed its reservation. Local `main` entered this resumption at `9af6c526a9500a0dbfb88e39ba0dee1eb7e1d097`; the worktree already contained an unfinished merge whose `MERGE_HEAD` was `26b52d76e3dedd754ca1b1c428abaa074b7f98da`.
@@ -255,6 +265,7 @@ Gate result:
 
 ## Outcome
 
+- 2026-08-17 module-access staged integration passed merged-tree verification and independent final review and is ready for its merge commit. Canonical reconciliation records the source tip `3b799af`, Main-owned four-boolean projection, default-open compatibility, `design` → `painting`, disabled card/root/deep/alias guards before initialization, Code policy hydration, terminal `401` dual-session cleanup, global `/settings`, and the client-entry-only security boundary; the exact merge SHA will be recorded only after Git creates it.
 - A mandatory pre-push fetch found authoritative `origin/main` had advanced to `01bee3188be4b03b6b358c2da60f1f9ed22d707f`, so no stale push was attempted. Started a second normal `--no-ff --no-commit` merge with reviewed local merge `bb16c1d12a24b2957149db960edba6e6660691aa` as first parent and `01bee31` as second parent; README was the only textual conflict and was reconciled to preserve both the enabled Learning module and the detailed Robot hotspot flow.
 - Preserved the remote Learning product scope, four-module navigation, profile reuse, removal of `game-engine`, and project-root `planning-with-files` output. The merged tree no longer depends on a sibling OpenMAIC checkout: CI/release packaging requires the fixed manifest artifact, while an explicit local source remains development-only.
 - Closed merge-audit security/correctness findings across Learning: strict Host/service DTO and safe-error projection; bounded Agent/ASR/runtime and ZIP consumption; Main-derived opaque account partitions for generation, local courses, IPC and player registration; fixed-binding checks across token acquisition, fetch and 401 refresh; stale account/epoch result rejection; 512 MiB archives; same-Works-origin redirects with a 5-hop cap and no resource Bearer; a nonce-protected account-bound player HTTP session; and an exact-source/origin single-document iframe bridge.
@@ -378,6 +389,11 @@ Gate result:
 
 ## Verification
 
+- 2026-08-17 module-access merged-tree focused Vitest — 4 files / 69 tests passed.
+- 2026-08-17 module-access merged-tree full Vitest — 175 files / 2047 tests passed.
+- 2026-08-17 merged-tree TypeScript `tsc --noEmit` and scoped ESLint on all changed TypeScript/TSX files — passed.
+- 2026-08-17 merged-tree Renderer/Electron Main/Preload `pnpm run build:vite` — passed; only the existing chunk-size and mixed static/dynamic import warnings remain.
+- 2026-08-17 independent staged-merge Sol review — `PASS`, no blocking Standards or Spec findings. It independently reran 69 focused tests, typecheck, scoped ESLint, `build:vite`, document drift, registry doctor and diff checks, and confirmed the intended two-parent topology and source-task-record exclusion.
 - Remote `01bee31` merged-tree `pnpm install --frozen-lockfile` passed with the package-pinned pnpm 10.33.4; Electron 40.10.6 was restored with `pnpm rebuild electron` before desktop smoke.
 - Learning/Robot/Canvas/publish/OpenCode focused selection — 26 files / 418 tests passed.
 - Bounded full unit suite — 175 files / 1944 tests passed.
@@ -503,6 +519,7 @@ Gate result:
 
 ## Follow-ups
 
+- Before releasing the per-user module-entry policy, deploy the Works `module_access` migration and `/api/auth/me` contract, build and install a new Makelore package, then use a real account to disable Code, Canvas, Learning and Robot one at a time and smoke chooser/root/deep/alias behavior, global settings, terminal `401`, and independent server-side API authorization.
 - Before releasing Learning, run a real Works account through catalog, generation/material/cancel-resume, bounded download, offline multi-module playback, progress, Agent, ASR and PBL/scoring using the exact production Stage artifact. Validate packaged loopback cookie/nonce behavior on Windows and a signed macOS build; current automation is not that acceptance.
 - Before restoring project cover upload or editing metadata on an existing draft/published project, add and verify a server-owned revision/ETag plus draft-only conditional write and atomic cover attachment or cleanup. Until then the client intentionally creates new projects without a cover and treats existing projects as version-only.
 - Complete the visible Git Credential Manager/PowerShell authentication prompt, then fetch and verify `origin/main` equals the local tip before recording push completion and releasing this Integration task.
@@ -528,6 +545,7 @@ Gate result:
 
 ## Promotion Candidates
 
+- The `3b799af` module-access candidate is promoted into current state, architecture/data flow, business rules, success criteria, evidence and commitments: Electron Main projects only four booleans from `/api/auth/me`; missing values are enabled, server `design` maps to client `painting`, disabled card/root/deep/alias entry stops before layout/module initialization, Code provider waits for policy hydration, terminal `401` clears both session layers, and `/settings` remains global. This is a client entry policy, not API authorization; deployment/package/real-account validation remains pending.
 - Remote `01bee31` facts and the reviewed merge hardening were promoted into README, AGENTS, success criteria, current state, architecture/data flow, business rules, glossary, evidence and commitments: Learning is enabled but remains Main-owned, account-partitioned, bounded, artifact-verified and pending real Works/signed-package acceptance; `game-engine` is removed and planning files belong in the project root.
 - Remote `26b52d7` facts were promoted into current state, architecture, domain rules, glossary, evidence, README, and release commitments: Prompt Museum remains read-only/server-driven, Quote pricing is service-owned, Canvas deletion is an explicit Workspace mutation, development is cloud-default, UI language is Chinese-only, and `game-engine` is an optional bundled Skill. Production Museum content and real-account billing/deletion acceptance remain pending commitments rather than completed evidence.
 - The default-on candidate from `b78fc07` was promoted into ADR-002, current state, decision/success criteria, Robot architecture/domain/glossary, README, and a concrete release-validation commitment. No unresolved canonical candidate remains; the missing native/physical evidence is tracked as a pending commitment rather than overclaimed.